The vulnerabiilty was used by Stuxnet malware together with CVE-2012-3015.
Vulnerable component: Siemens SIMATIC WinCC
CVSSv3 score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C
CWE-ID: CWE-259 - Use of Hard-coded Password
The vulnerability allows a local user to obtain hardcoded credentials.
The vulnerability exists due to usage of hardcoded password to access back-end database. A local user can obtain password and gain unaithorized access SCADA system.
Successful exploitation of the vulnerability may allow an attacker to gain complete control over the industrial process.
Note: this vulnerability is being actively exploited by the Stuxnet malware.
Known APT campaigns:
Iranian Nuclear Facilities breach
The breach was identified in summer 2010 by VirusBlokada antivirus company from Belarus, who was called to investigate computers in Iranian nuclear facilities.